The vulnerability CVE-2026-50034 in the Apollo Pharmacy Blood Glucose Monitoring System (Model No. APG-01 BT) allows an attacker within BLE range to passively intercept unencrypted wireless communications. This enables the attacker to obtain sensitive health data, including glucose measurement values, without requiring user interaction or privileges. The issue is categorized as CWE-319, which involves the exposure of sensitive information through unprotected communication channels. The CVSS vector indicates the attack requires adjacent network access (BLE range), has low attack complexity, no privileges or user interaction needed, and impacts confidentiality but not integrity or availability.

An attacker within BLE range can eavesdrop on wireless traffic from the affected device and access sensitive health information such as glucose measurements. This compromises the confidentiality of personal health data. There is no indication of impact on data integrity or device availability. The vulnerability does not require user interaction or elevated privileges, increasing the risk of passive data leakage.

No official patch or remediation is currently available for this vulnerability. Since the device is not a cloud service, remediation depends on the vendor providing a firmware update or device replacement. Users should be informed about the risk of passive data interception over BLE and consider limiting physical proximity of untrusted parties to the device. Monitor vendor advisories for updates or fixes addressing this issue.